nerdexam
Microsoft

SC-300 · Question #275

Hotspot Question Your network contains an on-premises Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains an Active Directory Federation Services (AD FS) instance…

The correct answer is The user account has a six-character password and is enabled. = Yes; The user account has a 12-character password and is enabled. = Yes; The user account has an eight-character password and is disabled. = Yes. This question tests knowledge of Microsoft Entra Connect synchronization behavior, specifically what can and cannot be managed in the cloud (contoso.com) versus on-premises (fabrikam.com) in a federated/hybrid identity environment.

Submitted by andreas_gr· Mar 6, 2026Implement identity management solution

Question

Hotspot Question Your network contains an on-premises Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains an Active Directory Federation Services (AD FS) instance and a member server named Server1 that runs Windows Server. The domain contains the users shown in the following table. You have a Microsoft Entra tenant named contoso.com that is linked to a Microsoft 365 subscription. You establish federation between fabrikam.com and contoso.com by using a Microsoft Entra Connect instance that is configured as shown in the following exhibit. You perform the following tasks in contoso.com: - Create a group named Group1. - Disable User2. - Enable User3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

SC-300 question #275 exhibit 1
SC-300 question #275 exhibit 2

Answer Area

  • The user account has a six-character password and is enabled.Yes
  • The user account has a 12-character password and is enabled.Yes
  • The user account has an eight-character password and is disabled.Yes

Explanation

This question tests knowledge of Microsoft Entra Connect synchronization behavior, specifically what can and cannot be managed in the cloud (contoso.com) versus on-premises (fabrikam.com) in a federated/hybrid identity environment.

Approach. In a federated hybrid identity setup using Microsoft Entra Connect, the on-premises AD DS is the authoritative source for synced objects. Groups created directly in the cloud (Entra/M365 tenant) like Group1 are cloud-only objects and will NOT sync back to on-premises AD DS - sync is unidirectional (on-premises to cloud) for directory objects. User enable/disable actions performed in the cloud tenant (contoso.com) for synced users are overwritten on the next sync cycle because the on-premises AD DS remains the source of authority; therefore, disabling User2 or enabling User3 in the cloud will be reverted by the next Entra Connect sync if the on-premises state differs. Only changes made in the on-premises AD DS will persist for synced user accounts. Cloud-only actions (like disabling a synced user in Entra ID) are temporary and get overwritten, so the statements about User2 remaining disabled and User3 remaining enabled in the cloud after sync would be 'No' unless the on-premises state matches.

Concept tested. Microsoft Entra Connect synchronization direction and source of authority: in hybrid identity, on-premises AD DS is the authoritative source for synced objects, meaning cloud-side changes to synced users/groups are overwritten by subsequent sync cycles, and cloud-created groups do not replicate back to on-premises AD DS.

Reference. Microsoft Learn: Microsoft Entra Connect sync - understand and customize synchronization; Hybrid Identity documentation on source of authority and sync direction.

Topics

#AD FS#federation#Microsoft Entra Connect#hybrid identity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice